The $60 TV Box On Your Network Is Working For Somebody Else

Last week we wrote about what happens when the company you trust to vouch for other companies quietly quits. The certificate authority story. The lesson was about delegated trust.

There is a harder version of that lesson, and Google announced it on November 2. More than 1.3 million Android devices shipped from a factory with a remote control system already installed, wired to a command server, and sold to criminals who turned your television into a customer of theirs. It was not a bug. Google says with high confidence that the manufacturer, Videostrong Technology of Shenzhen, built the backdoor deliberately and sold access to criminal affiliates.

Read that sentence again. The device manufacturer was the threat actor. Not a supply chain compromise, not a hacker who got in. The company that built the box made the money from the box, and the buyer never had a chance to know.

What Was Actually Sold

Google Threat Intelligence’s report, published November 2, is unusually detailed for a botnet takedown. The implant is called `x.cpe`, and it ships in the firmware partition at the `android.uid.system` privilege level. It presents itself as an ordinary remote-management agent. The loader that follows is `com.abc.nexus`, which runs with system privileges and enrolls the device in revenue streams.

The persistence is what makes this unfixable by the owner. If you uninstall `x.cpe`, it reinstalls itself from the `/oem/` partition on the next reboot, running as a system app signed with the manufacturer’s key. TrendAI’s researchers put it plainly: cleanup needs vendor action, platform protection, or replacement of the device.

Beyond the money, the implant had capabilities. Google observed operators taking live screenshots, injecting keystrokes, copying out account details, and opening reverse shells. It collected Wi-Fi and Bluetooth settings, and ran a traceroute binary to fingerprint the network the device sat on. That last one should make a business owner sit up. The device was mapping the network it was plugged into.

The Numbers Behind The Story

TrendAI measured the operation from June 3 to October 1, 2026. Their telemetry counted 1,472,554 infected devices across 206 models in more than 170 countries. About 1.33 million of those were actively scheduled for proxy and ad fraud work.

Over those four months the botnet pushed 3,849,226 distinct residential exit IP addresses, averaging 182,025 available on any given day with a peak of 366,562. TrendAI captured 2,360,663,001 control messages. On a typical day, the operator was selling access to roughly 180,000 real household connections.

Now think about what that product is. A residential proxy sells the fact that traffic appears to come from an ordinary household. Fraudsters use it to beat the IP reputation and geolocation checks that banks, retailers and ticket sites rely on. Your customer’s home connection, your employee’s home connection, your own office connection, all rentable by the hour. The same devices can do the other job too, since Google’s analysis found ad fraud modules that fired tracking beacons for impressions without ever displaying an ad.

Why Blocklists Do Not Save You

Here is the sentence from TrendAI’s report that matters most for anyone who runs a firewall: traffic from these devices arrives from the same networks as your real customers and your remote employees. Blocking data-center IP ranges would not and did not catch it. That is the entire reason residential proxies are worth money. They are not hosted in a data center in an offshore country. They are in the building your customer lives in, on the same consumer broadband block as the rest of the neighborhood.

This is not new. The FBI published a Public Service Announcement in June 2025 on BADBOX 2.0, warning that criminals were compromising IoT devices on home networks, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and picture frames. The two most common infection paths were preloading the device with malicious software before purchase, or compromising it during setup while it downloaded required applications from unofficial app stores. BADBOX 2.0 compromised more than 10 million uncertified AOSP devices.

That was the previous chapter. XCPE is the next one, and this time the manufacturer was certified and the devices carried a Google badge. Google’s response was to permanently ban Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices.

Which brings up the part nobody wants to say. Google’s certification program requires manufacturers to pass security tests, and Videostrong exploited a gap in them, loading malicious code after a device’s first boot. The program is the control, and the control was bypassed by a company getting paid per device. That is not a bug in a patch. It is a structural problem with voluntary certification in a market where the cheapest device wins and nobody wants to pay for a security review a competitor will skip.

The FBI’s June 2025 indicators are still the most practical checklist anyone has published: suspicious app marketplaces, devices requiring Play Protect to be disabled, generic TV streaming devices advertised as unlocked, IoT devices from brands you have never heard of, and unexplained internet traffic. The gap is that those signals only matter if somebody is looking, and in a small business with a dozen IoT devices on a flat network, nobody is looking.

Five Things You Can Do This Week

1. Inventory every device that touches your network and ask one question about each: does it need to be there? A $40 streaming box in a conference room is a $40 remote shell on the same segment as your file server. Pull the ones that exist for convenience, not requirement.
2. Put IoT and guest devices on their own segment with no route to your internal network. The office version of TrendAI’s advice for remote staff: a separate VLAN that can reach the internet and nothing else.
3. Check the models against the published list before you buy, not after. Synthient published 182 affected model names, with the caveat that a model name alone does not confirm infection. Buying from a white-label brand with no reputation is a decision, and it should be a conscious one.
4. Look for the behavioral tells in your firewall logs. An idle TV box that suddenly talks to unfamiliar hosts on port 8000, or sustained outbound traffic to residential proxy ranges, or a device contacting MQTT brokers, is telling you something. The FBI also recommends watching for outbound traffic to ports 12108 and 5555, associated with Android Debug Bridge shells left exposed.
5. For remote staff, require managed devices for anything touching company data. A consumer device on a home network, once mapped, gives the attacker the household’s entire environment, not just the one laptop. Your data should not be reachable from a laptop sharing a subnet with a compromised smart TV.

Where This Goes

Google’s own framing is more sober than the headlines suggest. They took down the control domains for over a dozen malware families loaded through the backdoor, and they estimate this severs access to at least 10 million more compromised devices. But they also warn that backdoor operators switch to new tools quickly when one piece of their setup is disrupted, and that backdoor operators, ad fraud rings and residential proxy providers operate as an interconnected supply chain. Point-in-time disruption, in their words, is a critical tool, but lasting disruption requires continued targeting.

So the XCPE takedown is a win, and it is also a preview. The next one will have a different implant name, a different manufacturer, and a different set of monetization modules. The playbook is now public and the tooling is cheap.

The durable defensive move is not chasing C2 domains. It is refusing to give cheap unmaintained hardware a place on your network, segmenting what remains, and assuming the certification badge on a device tells you less about its trustworthiness than the vendor’s willingness to pay for independent security review. The manufacturer in this story passed Google’s tests, then shipped malware to 1.3 million customers anyway. Trust the review process less than you think you do. Trust your own segment list more.

Sources

• Shutting the Door on the XCPE Botnet (Google Threat Intelligence, Nov 2, 2026)
• TrendAI Research Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes (Nov 2, 2026)
• Home Internet Connected Devices Facilitate Criminal Activity (FBI Public Service Announcement, June 5, 2025)
• Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access (The Hacker News)
• Top threat trends of the 2025 botnet landscape (Barracuda Networks)
• A Broken System Fueling Botnets (Synthient, Kimwolf research)